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This module should be read in conjunction with the Introduction and with the 
Glossary, which contains an explanation of abbreviations and other terms used in 
this Manual. If reading on-line, click on blue underlined headings to activate 
hyperlinks to the relevant module. 


Purpose 


To set out the approach which the HKMA will adopt in the supervision of Als’ 
strategic risk, and to provide guidance to Als on the key elements of effective 
strategic risk management 


Classification 
A non-statutory guideline issued by the MA as a guidance note 


Previous guidelines superseded 
This is a new guideline. 


Application 
To all Als 


Structure 


1. Introduction 
1.1 Terminology 
1.2 Background 
1.3 Scope 
1.4 Related legal provisions 
1.5 Implementation 
2. Supervisory approach to strategic risk 
2.1 Supervisory objectives 
2.2 Supervisory process 
2.3 Supervisory assessment 
2.4 Application to local banking groups 
2.5 Application to foreign bank branches and subsidiaries 
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3. Strategic risk management framework 
3.1 Overview 
3.2 Key components 
4. Strategic risk management structure 
4.1 Overview 
4.2 Role of Board and senior management 
4.3 Role of functional departments 
4.4 Role of strategic risk management function 
5. Strategic risk management process 
5.1 Overview 
5.2 Strategic planning 
5.3 Alignment and change management 
5.4 Implementation and monitoring 
5.5 Performance evaluation and feedback 
6. Other supporting processes 
6.1 Planning and management of capital and funding needs 
6.2 Management information systems 
6.3 Stress-testing and contingency strategies 
6.4 | Human resources management and development 
6.5 Independent reviews and audits 


Annex A: Common causes of strategic failure 


Annex B: Strategic risk profile — summary of major characteristics by risk 
category 
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1. Introduction 


1.1 Terminology 


1.1.1 This subsection sets out the meanings of strategic risk and 
other related terms used in this module. 


1.1.2 “Strategic risk” means the risk of current or prospective impact 
on an Al’s earnings, capital, reputation or standing arising from 
changes in the environment the Al operates in and from 
adverse strategic decisions, improper implementation of 
decisions, or lack of responsiveness to industry, economic or 
technological changes. It is a function of — 


e the compatibility of an Al’s strategic goals; 

e the strategies developed to achieve those goals; 
e the resources deployed to meet those goals; and 
e the quality of implementation. 


The resources needed to implement an Al’s strategies are both 
tangible and intangible. They include capital and funding, 
communication channels, staffing and operating systems, 
delivery networks, and managerial resources and capabilities. 


1.1.3 “Strategic risk management framework” means collectively the 
systems, processes and controls adopted by an Al to identify, 
assess, monitor, control and report strategic risk. 


1.1.4 “Strategic goal’ means a general statement of purpose or a 
short, medium or long term goal set by an Al in line with its 
corporate mission and values, with a view to achieving desired 
outcomes in relation to growth, efficiency, survival and control 
of the environment’. 


1.1.5 “Strategic objective” means a specific, measurable and time 
assigned objective or target derived from an Al’s strategic 
goal(s). 


' This includes responsiveness to environmental changes, effective resources management and securing a 


strong competitive position in the market. 
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1.2 


“Strategic plan” means a comprehensive plan formulated by an 
Al in its strategic planning process. The plan sets out, among 
other things, the strategies to be implemented by the Al, the 
manner of implementing those strategies, and the desired 
outcomes expected of such implementation. 


“Strategy” means the approach, method or course of action 
that can be taken by an Al to achieve a particular strategic goal 
or objective. There are typically three levels of strategy (i.e. 
corporate, business, and operational) that may be employed, 
the characteristics of which are explained as follows: 


e a corporate strategy is concerned with an Al’s overall 
purpose and development, and relates to how the Al’s 
strategic intent or vision could be achieved. For example, 
an Al may decide to attain targeted growth through 
strategic alliances, mergers and acquisitions; 


e a business strategy is usually concerned with how an Al 
can gain competitive business advantage, which products 
or services the Al should offer to customers, or which 
markets the Al should operate in. This level of strategy 
relates more to the affairs of particular business units (e.g. 
development of retail banking business in Mainland China) 
than to the Al as a whole; and 


e an operational strategy is developed to support or facilitate 
the implementation of corporate and business strategies. 
Examples include strategies for enhancing organisational 
efficiency, IT infrastructure and human resources 
management. 


Any reference to the term “strategy” in this module embodies 
the three levels of strategy described above. 


“Strategic decision” means an Al’s decision to implement a 
specific strategy. 


Background 


1.2.1 


An Al’s ability to manage strategic risk is crucial to its survival 
and long range development. Strategic risk management is 
primarily concerned with how an Al relates itself to the 
environment it operates in, and the choices it makes in 
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1.2.2 


1.2.3 


1.2.4 


response to changes in the environment and on the 
deployment of capital and resources in ways that create 
competitive advantage for the Al as a whole. As strategic 
decisions affect the future, an inevitable amount of risk and 
uncertainty is involved. Inadequate strategic planning or 
improper implementation of strategies may expose Als to 
significant business and financial losses, and may also have a 
knock-on effect on their reputation and market standing. 


Moreover, the driving force behind many banking crises 
appeared to be a change in the institutional or external 
environment coupled with a choice of unsuitable strategies by 
banks. For example, a bank which is facing keen competition 
may be induced to run greater risks than it can endure to 
preserve its profitability. The potential dangers of a shift 
towards higher “risk-return” couplings may not materialise 
immediately if the business conditions remain favourable. If 
the economy turns bad, the adverse consequences for such 
banks are greatly increased, thereby severely affecting their 
financial conditions and performance. 


Many strategic problems could also be directly related to 
management and staff issues within an organisation. These 
may result from the lack of good succession plans for senior 
management and other key managerial positions, insufficient 
operational and staff support for new initiatives, inadequate in- 
house technical expertise to carry out highly specialised 
projects, or staff resistance to cultural changes (e.g. changes 
in working habits, skills and proficiency standards, and 
traditional beliefs and expectations). If all such issues or 
changes cannot be successfully managed, they may 
significantly undermine the effective implementation of 
strategies. 


The HKMA therefore considers it important for Als to put in 
place an effective process for managing strategic risk. This is 
consistent with Principle 7 of the revised “Core Principles for 
Effective Banking Supervision” issued by the Basel Committee 
whereby banks are expected to have a comprehensive risk 
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1.3 


1.2.5 


Scope 


1.3.1 


1.3.2 


management process in respect of all material risks (including 
strategic risk).° 


Annex A illustrates some common causes of strategic failure 
for Als’ reference. Als are expected to bear those examples in 
mind when structuring their strategic risk management 
framework. 


The HKMA recognises that strategic risk is one of those risks 
for which no (or only rudimentary) quantification methods exist, 
and various techniques or tools for managing strategic risk are 
still evolving. Hence, this module does not attempt to introduce 
or mandate any specific methodology or technique for 
measuring or controlling strategic risk. Rather, the guidance 
provided in this module mainly — 


e draws upon the HKMA’s past experiences in supervising 
strategic risk and elaborates on the approach taken; 


e sets out risk management practices that Als are 
recommended to follow; and 


e promotes the adoption by Als of a formalised and 
structured approach to managing strategic risk. 


This module could be read in conjunction with the following 
modules which contain risk management standards that are 
relevant to strategic risk: 


e CG-1 “Corporate Governance of Locally Incorporated 
Authorized Institutions”; 


e  |C-1 “General Risk Management Controls’; 
e SA-1 “Risk-based Supervisory Approach’; 
e |C-5 “Stress-testing”; and 


e CA-G-5 “Supervisory Review Process”. 


The relevant information is contained in the Basel Committee paper on “Core Principles Methodology” 
updated in October 2006. 
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1.3.3 


The HKMA will continue to monitor international developments 
on strategic risk management practices. This module may 
therefore be subject to revision and additional guidance, as 
internationally accepted standards and practices on strategic 
risk management emerge over time. 


1.4 Related legal provisions 


1.4.1 


1.4.2 


While this module does not have the force of law, the 
adequacy of an Al’s strategic risk management framework has 
a bearing on the HKMA’s assessment of the Al’s ongoing 
compliance with the following authorization criteria: 


e Para. 10 of the Seventh Schedule to the Banking 
Ordinance requiring Als to maintain adequate accounting 


systems and systems of control. These are essential for 
ensuring the prudent and efficient running of the business, 
safeguarding the assets of the Al, minimising the risk of 
fraud, monitoring the risks to which the Al is exposed and 
complying with legislative and regulatory requirements; 
and 


e Para. 12 of the Seventh Schedule to the Banking 
Ordinance requiring Als to conduct their business with 


integrity, prudence and professional competence and ina 
manner which is not detrimental to the interests of 
depositors or potential depositors. In assessing 
compliance with this criterion, the HKMA will take account 
of, among other considerations, strategic risk issues such 
as the Al’s general strategy and objectives and its ability to 
plan ahead as well as its track record, including its ability 
to deal with external shocks and unexpected 
contingencies. 


In implementing strategic decisions, Als should be aware of 
various legal requirements applicable to them under the 
Banking Ordinance. For example, locally incorporated Als are 
required to obtain the MA’s prior approval in the following 
cases: 


e establishment of local branches under §44 (also applicable 
to overseas incorporated Als); 
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1.4.3 


1.4.4 


e establishment of overseas branches and overseas 
representative offices under §49; 


e establishment of overseas banking subsidiaries under 
§51A (see CG-4 “Establishment of Overseas Banking 
Subsidiaries: §51(A)” for more details); 


e making any major acquisition and investment under §87A 
(see CR-L-5 “Major Acquisitions and Investments: §87A” 
for more details); and 





e becoming a controller of any Al under §70. 


Als wishing to carry on certain regulated activities specified 
under the Securities and Futures Ordinance should ensure 
that they comply with all relevant requirements under that 
Ordinance (e.g. applying to the SFC for becoming a registered 
institution under section 119) and the Banking Ordinance (e.g. 
appointing not less than two executive officers under §71D and 
obtaining the MA’s consent for such officers under §71C). See 
SB-1 “Supervision of regulated activities of SFC-registered 
authorized institutions” for more details. 


Als would also be expected to consult with the HKMA on any 
plans to implement strategies (including major changes to 
existing strategies) which may have significant effects on their 
business operations, financial conditions (including capital 
adequacy) and risk profile, notwithstanding that there may be 
no statutory requirement to do so. Examples of such cases 
include undertaking a major expansion of an already highly 
concentrated property lending portfolio and conducting new 
lines of business or activities of higher risk in which the Al 
concerned has no prior experience or expertise. 


1.5 Implementation 


1.5.1 


Als are expected to develop their strategic risk management 
framework consistent with the guidance laid down in this 
module, and ensure that such a framework is commensurate 
with the nature, size and complexity of their business and is 
appropriate for their individual circumstances and needs. 


Recognising, however, that enhancing an Al’s strategic risk 
management capabilities is an ongoing process, the HKMA 
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1.5.3 


would not expect every existing Al to be meeting all risk 
management practices recommended in this module 
immediately after the module is issued. Nevertheless, they are 
expected to identify areas where such practices should be 
applied to their strategic risk management framework, and 
make steady progress towards applying them within a 
reasonable timeframe. The HKMA will monitor their progress 
in enhancing such framework and take into account the 
progress achieved in determining its supervisory priorities. 


Where Als have adopted a strategic risk management 
framework that may not fully align with those recommended 
practices, they should provide adequate justifications for the 
approach taken and be able to demonstrate to the HKMA’s 
satisfaction that alternative measures are in place to control or 
mitigate strategic risk. 


2. Supervisory approach to strategic risk 


2.1 Supervisory objectives 


2.1.1 


2.1.2 


Strategic risk is one of the eight inherent risks? which the 
HKMA has identified as risks to be assessed under its risk- 
based supervisory process (see SA-1 “Risk-based Supervisory 
Approach” for more details). Als are required to establish a 
sound and effective system to manage each of these risks. 


The main objectives of the HKMA’s risk-based supervisory 
approach in respect of strategic risk are to assess — 


e the level and trend of Als’ strategic risk; 


e the adequacy and effectiveness of their strategic risk 
management framework; and 


e their strategic risk profile. 
In the case of locally incorporated Als, the adequacy of their 


capital relative to the level of their strategic risk and the 
soundness of their strategic risk management framework will 





3 The other seven inherent risks are credit, market, interest rate, liquidity, operational, reputation and legal risks. 
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also be assessed as part of the SRP (see CA-G-5 
“Supervisory Review Process” for more details). 

2.1.4 Results of the HKMA’s assessment under paras. 2.1.2 and 
2.1.3, together with the assessment results for other inherent 
risks, will be used for determining the overall risk profile and 
supervisory priorities of Als and, in the case of locally 
incorporated Als, their minimum CAR. 

2.2 Supervisory process 


2.2.1 


2.2.2 


2.2.3 


Under its risk-based supervisory approach, the HKMA 
exercises continuous supervision of Als’ strategic risk through 
a combination of risk-focused on-site examinations, off-site 
reviews and prudential meetings. 


The HKMA monitors the strategic risk profile of Als (including 
changes in their level and direction of strategic risk) during off- 
site reviews and prudential meetings, and evaluates the 
effectiveness of their strategic risk management framework 
during on-site examinations. In the case of locally incorporated 
Als, the HKMA will additionally assess how strategic risk is 
being dealt with under their corporate governance structure 
and capital adequacy assessment process, as part of the SRP. 


In evaluating Als’ strategic risk management framework, the 
HKMA will adopt a system-based approach that puts the main 
focus on the systems, processes and controls established by 
Als. To facilitate its assessment, the HKMA will obtain relevant 
information from Als which may include, but is not limited to, 
the following: 


e management guidelines and written procedures on 
strategic risk management (including planning and 
budgeting procedures); 


e current strategic / business plans* and other associated 
implementation plans; 


Where necessary, the HKMA may agree with individual Als the manner in which such plans will be reviewed. 
For example, in cases where the full strategic plan is compiled by the head office of a foreign-owned Al 
covering other group operations, the Al may present or provide extracts of those parts of the plan relevant to 
the local operation to the HKMA. 
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2.2.4 


2.2.5 


2.2.6 


e composition of Board or executive management 
committees and other risk control units responsible for 
strategic planning and management (including, where 
applicable, their terms of reference, reporting lines and 
authorities, and frequency of meetings); 


e minutes of Board or committee meetings and discussion 
papers with regard to strategic planning and management; 


e performance evaluation reports (actual versus plan); 


e results of any independent review or audit relating to 
strategic risk management; and 


e other management reports submitted to the Board and 
senior management to facilitate strategic risk 
management. 


The HKMA will also hold periodic discussions with Als’ Board 
and senior management (e.g. during annual Board or 
prudential meetings) to gain insight into their strategic planning 
and management processes, including — 


e latest strategies, business direction and outlook, and 
plans for change in activities or management processes; 


e reasons for performance variances; and 


e comments on any strategic risk issues or risk 
management weaknesses identified. 


The HKMA will adopt a proportionate approach when applying 
the risk management guidance set out in this module to Als of 
varying size and complexity. For example, Als with small, 
simple operations will not be expected to have a strategic risk 
management process as elaborate as those with more 
complex operations. Nevertheless, they should, at a minimum, 
be able to demonstrate that their strategic risk management 
process covers the key elements set out in para. 5.1.1, 
although the procedures and documentation involved can be 
much more simplified. 


If deficiencies are found in an Al’s strategic risk management 
framework, the HKMA will enter into discussions with the Al 
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2.2.1 


and seek prompt remedial action. Depending on the 
circumstances of each case, the HKMA may require the Al to 
take specific actions to mitigate particular concerns (e.g. in 
respect of an investment or strategy that has gone into 
problems). 


Under §59(2) of the Banking Ordinance, the MA has the power 
to require an Al, after consultation with the Al, to provide an 
auditors’ report on such matters as he may specify for the 
performance of his functions under the Ordinance. The MA 
may exercise this power to commission an auditors’ report, for 
example, when he considers that an independent review of the 
Al’s strategic risk management framework is warranted. 


2.3 Supervisory assessment 


2.3.1 


2.3.2 


This subsection describes the key factors that will be 
considered by the HKMA in assessing — 


e the level and trend of Als’ strategic risk; 


e the adequacy and effectiveness of their strategic risk 
management framework; and 


e their strategic risk profile. 
The HKMA will use a combination of techniques, such as 


qualitative analysis, peer group comparison and supervisory 
judgement, in its assessment of strategic risk. 


Level and trend of Als’ strategic risk 


2.3.3 


The HKMA will have regard to the following factors in 
assessing the level and trend of an Al’s strategic risk: 


e Compatibility or suitability of the Al’s strategic goals and 
objectives — the HKMA will consider whether — 


- the Al’s strategic goals and objectives are compatible 
with its corporate mission and values, culture, business 
direction and risk tolerance; 


- the Al’s financial objectives are consistent with its 
strategic goals; and 
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- the Al’s strategic decisions are generally prudent 
relative to its size and complexity; 


Responsiveness to changes in the environment — the 
HKMA will assess whether the Al’s strategic decisions are 


indicative of its responsiveness to changes in the 
environment (including those developments resulting in 
technological, economic, competitive or regulatory 
changes). This assessment will include the timeliness of 
making such decisions; 


Adequacy of resources in carrying out strategic 
decisions — the HKMA will review whether the Al has 


adequate resources (both tangible and intangible) for 
implementing its strategic decisions, including its potential 
or capability to enter into new markets, businesses, 
products or services. Such resources relate to capital and 
funding, staffing and operating systems, communication 
channels, delivery networks, and managerial resources 
and capabilities; 


Implementation of strategic decisions — the HKMA will 
determine whether the Al has a successful track record in 


implementing strategic decisions based on its past 
performance in respect of — 


- offering new products and services; 


- shifting of business focuses or re-focusing of business 
initiatives; 


- conducting strategic investments, forming joint 
ventures or implementing merger and acquisition 
plans; and 


- meeting business targets for major business units and 
operations (including overseas branches, banking 
subsidiaries and associates); 


Impact of strategic decisions — the HKMA will consider if 
there has been any strategic decision, or external pressure 
arising from such decision, that has severely affected the 
Al’s reputation or financial position or that could not be 
reversed without significant cost or difficulty. In addition, 
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2.3.4 


the HKMA will review if there are any risk mitigating factors 
that will help reduce the overall impact of adverse market 
conditions. For example, the Al’s business may be fairly 
diversified by product, geography and customer 
demographics; and 


e any other warning signals of high potential strategic risk 
specific to the Al concerned. 


The HKMA will adopt a forward-looking approach and take into 
account any significant changes (either arising from 
institutional or external conditions) in the past year that may 
affect the direction of an Al’s strategic risk in the coming year 
(i.e. whether the level of strategic risk is “increasing”, “stable” 
or “decreasing”). The strategic performance of the Al and its 
peers will also be compared. 


Strategic risk management framework 


2.3.5 


In assessing the adequacy and effectiveness of an Al’s 
strategic risk management framework, the HKMA will have 
regard to the following factors: 


e the appropriateness of the framework relative to the Al’s 
nature, size and complexity of business; 


e the overall effectiveness of the framework, taking into 
account the extent to which the Al has adopted the risk 
management practices recommended in this module, or 
other comparable practices that serve similar purposes; 


e the appropriateness of the Al’s strategic risk management 
structure (see section 4 for more guidance), including — 


- the level of oversight exercised by the Board and 
senior management, and their knowledge and 
expertise, in strategic planning and management; and 


- the level of support provided by the strategic risk 
management function, whether as a standalone or 
integrated function, and other functional departments; 


e the effectiveness of the Al’s strategic risk management 


process (see section 5 for more guidance), including 
whether — 
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there is a sound strategic planning process for 
formulating the Al’s strategic goals and objectives, 
which should be consistent with its corporate mission 
and values and stated risk tolerance, and for 
translating those goals and objectives into a well- 
structured strategic plan for delivery and measurement 
of desired outcomes; 


the personnel, technology, funding and capital 
resources allocated, and the priority assigned, to the 
implementation of strategies are compatible; 


the methods of communicating, implementing, 
monitoring and modifying strategies are effective; 


there is a performance evaluation and feedback 
mechanism that checks on the success of strategies 
implemented and provides recommendations for 
improvement and further development; 


e the effectiveness of other processes for supporting the Al’s 
strategic planning and management (see section 6 for 
more guidance), including — 


the planning and management of capital and funding 
needs for implementing strategic decisions; 


the availability of management information systems 
(“MIS”) to facilitate environmental analyses and 
reporting to the Board and senior management on 
strategic risk issues; 


the use of stress tests, where appropriate, to identify 
any threats posed to the strategic plan in a timely 
manner; 


the maintenance of policies and procedures for human 
resources management and development to support 
the Al’s strategic needs; and 


the conduct of independent reviews and audits, where 


necessary, to ensure overall integrity of the strategic 
risk management process. 
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2.4 


2.5 


Strategic risk profile 


2.3.6 


2.3.7 


Based on the above assessment results, the HKMA will decide 
upon an Aľs strategic risk profile (categorised as “low”, 
“moderate” or “high”). See Annex B for a summary of major 
characteristics under each of these risk categories. 


Where necessary, the HKMA will discuss with the Al concerned 
the assessment results on strategic risk, and any issues or 
concerns arising therefrom. 


Application to local banking groups 


2.4.1 


2.4.2 


The HKMA normally expects a local banking group” to apply its 
strategic risk management framework on a group basis, i.e. 
covering its subsidiaries and overseas branches, and will assess 
such framework at the group level. 


If, however, any of the subsidiary Als within a local banking 
group is operating independently with a standalone strategic risk 
management framework, the HKMA will assess the framework 
of that Al separately. Under these circumstances, the parent Al 
needs to demonstrate to the HKMA’s satisfaction that the group 
has in place adequate controls to monitor the subsidiary Al’s 
strategic planning and management processes and to ensure 
that the Al’s strategies are formulated and implemented in line 
with the group’s strategic goals and objectives. The parent Al 
also needs to demonstrate what significant impact the subsidiary 
Al’s activities may have on the group’s operations and financial 
position if such activities are not covered in the group’s strategic 
plan. 


Application to foreign bank branches and subsidiaries 


2.5.1 


In the case of Als which are branches or subsidiaries of a 
foreign bank, the HKMA will not require them to establish and 
maintain a standalone strategic risk management framework in 
Hong Kong if all or some of the relevant systems, processes 
and controls (e.g. strategic planning or conduct of stress tests 
for strategic risk management purposes) are centrally 
managed by their group or regional offices. 





5 


This refers to a banking group in which the bank holding company is a locally incorporated Al. 
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2.5.2 


2.5.3 


2.5.4 


These Als should, however, be able to explain and 
demonstrate to the HKMA’s satisfaction how their group’s 
strategic risk management framework is applied to cover their 
activities (having regard to local strategic issues and 
environmental conditions), and how such framework is 
conducted in accordance with risk management practices 
adopted by their head office or parent bank. 


These Als should also have the primary responsibility of 
providing the HKMA with any information, documentation and 
evidence that the HKMA may require for ascertaining that the 
relevant systems, processes and controls are acceptable to the 
HKMA. For example, the HKMA may require a branch or 
subsidiary Al to provide an independent review or audit report 
on the integrity of the strategic risk management framework, or 
any part of the framework, as it relates to the Al. 


If the above-mentioned criteria cannot be met, the HKMA will 
consider requiring the Al concerned to establish and maintain 
its own strategic risk management framework in Hong Kong or 
taking any other appropriate supervisory measures. 


3. Strategic risk management framework 


3.1 Overview 


3.1.1 


3.1.2 


Every Al is expected to develop an appropriate framework for 
managing strategic risk, regardless of its size or complexity. 
The HKMA recognises that there is no single framework which 
would suit every Al. As such, Als should focus on developing a 
strategic risk management framework that fits their risk profile 
and level of sophistication, and ensure that their strategic risk 
is consistently and comprehensively identified, assessed, 
monitored, controlled and reported. 


The HKMA does not intend to prescribe the manner in which a 
strategic risk management framework should be structured. 
Therefore, the strategic risk management framework set out in 
sections 3 to 6 of this module mainly serves to illustrate the key 
elements of strategic risk management that the HKMA expects 
to see in such a framework, and provide relevant risk 
management guidance to Als. Als are not precluded from 
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adopting alternative approaches if they can justify that such 
approaches fulfil similar purposes. 


3.2 Key components 


3.2.1 An appropriate strategic risk management framework is 
expected to have the following components: 


e a strategic risk management structure that assigns 
responsibilities to various organisational functions to 
enable Als to achieve their strategic goals and objectives 
while managing the risks involved within an acceptable 
level; 


e a strategic risk management process that includes the 
following key elements: 


strategic planning to enable Als to more effectively 
anticipate and adapt to change and allow them to be 
more proactive in shaping their own future; 


alignment and change management, where necessary, 
to ensure that (i) internal resources and processes can 


cater for changes arising from implementation of new 
strategies, (ii) relevant individuals responsible for 
implementation acquire the necessary skills, and (iii) a 
culture of acceptance of change is present for 
implementing strategic changes; 


implementation and monitoring to facilitate Als in 
effectively implementing their strategies and monitoring 


the progress of implementation; 


performance evaluation and feedback to facilitate Als 
in taking prompt actions to address deviations of actual 
results from desired outcomes and provide 
recommendations for improvement and further 
development; and 


e other supporting processes, including  stress-testing, 
planning and management of capital and funding needs, 
MIS, human resources management and development, 
and independent reviews and audits. 
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3.2.2 Diagram 1 below provides a graphical presentation of the 


components described above. 


Diagram 1 : Strategic risk management framework 


| BOARD AND SENIOR MANAGEMENT OVERSIGHT 


Strategic Risk Management Process 


4. Strategic risk management structure 


4.1 


Overview 





STRATEGIC 


FUNCTION 





Foo 7raoomn 





FUNCTIONAL 
DEPARTMENTS 








4.1.1 Strategic risk management involves various organisational 


functions within an Al, including — 
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4.2 


e the Board and senior management overseeing the proper 
set-up and effective functioning of the strategic risk 
management framework; 


e the functional departments (i.e. departments which carry 
out business or operational functions) assisting the Board 
and senior management in formulating and implementing 
strategies, and in providing input to the strategic planning 
and management processes; and 


e the strategic risk management function supporting the 
Board and senior management in managing strategic risk 
and other related processes. 


Their respective role and responsibilities in strategic risk 
management are broadly described in this section. 


It is open to Als how they precisely define their strategic risk 
management structure. Nevertheless, the above-mentioned 
functions should be present and kept separate, and those 
charged with specific responsibilities in relation to strategic risk 
should clearly understand their responsibilities, authority levels 
and accountability under the strategic risk management 
framework. 


Role of Board and senior management 


General 


4.2.1 


4.2.2 


The ultimate responsibility for managing strategic risk rests 
with the Board. Senior management, on the other hand, is 
responsible for effective implementation of the strategic risk 
management framework developed in accordance with the 
Board’s criteria and standards. 


To adequately discharge their overall responsibility for strategic 
risk, the Board and senior management of an Al are expected 
to — 


e understand the Al’s current and prospective business and 


operating activities and their significance, as well as the 
Al’s corporate culture, risk profile, financial conditions, 
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systems and controls, and availability of resources 
(whether tangible or intangible); 


be capable of analysing the Aľs strengths and 
weaknesses and the impact of environmental changes 
(including key institutional and external factors) on the Al 
and its ability to develop successful strategies, as well as 
identifying opportunities and threats for the Al; 


comprehend the potential risks posed to the Al by each 
approved strategy, particularly in respect of those involving 
expansion through strategic alliances, mergers and 
acquisitions, or entry into new markets or business 
activities; and 


be alert to any strategic issues, recognise their strategic 
importance and, where necessary, take prompt actions 
(e.g. shift strategic focus or modify strategic decisions) to 
address those issues. 


Specific responsibilities of the Board 


4.2.3 The Board has specific responsibilities for overseeing an Al’s 
strategic risk management process. These include — 


ensuring that the Al has in place an appropriate strategic 
risk management framework which suits its own 
circumstances and needs; 


ensuring that the Al’s strategic goals and objectives are 
set in line with its corporate mission and values, culture, 
business direction and risk tolerance; 


approving the Al’s strategic plan (including strategies 
contained therein) and any subsequent changes, and 
reviewing the plan (at least annually) to ensure its 
appropriateness; 


ensuring that the Al’s organisation structure, culture, 
infrastructure, financial means, managerial resources and 
capabilities, as well as systems and controls are 
appropriate and adequate to support the implementation of 
its strategies; 
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4.2.4 


e reviewing high-level reports periodically submitted to the 
Board on the Al’s overall strategic risk profile, and 
ensuring that any material risks and strategic implications 
identified from those reports are properly addressed; and 


e ensuring that senior management is competent in 
implementing strategic decisions approved by the Board, 
and supervising such performance on a continuing basis. 


Where appropriate, the Board may consider delegating other 
responsibilities relating to the actual implementation of 
strategic decisions (e.g. approving and reviewing business and 
implementation plans) to specialised committees under the 
Board or other designated management committees. 
However, the authorities and responsibilities delegated should 
be clearly defined. Written terms of reference of each 
delegated committee should also be maintained and updated 
appropriately. The Board should be conscious that it remains 
ultimately responsible for those committees’ decisions. 
Therefore, the Board should establish adequate controls to 
monitor their performance and to ensure that its directives are 
properly followed. 


Specific responsibilities of senior management 


4.2.5 


In ensuring effective strategic risk management within an Al, 
senior management should, among other things — 


e establish and implement the Aľs strategic risk 
management framework based on criteria and standards 
set by the Board; 


e assist the Board in developing strategies to meet the Al’s 
strategic goals and objectives; 


e formulate the Al’s_ strategic plan and related 
implementation plans (such as business, development and 
operating plans); 


e ensure adequate implementation of the Al’s strategic plan, 
as approved by the Board, through — 


- allocation of appropriate resources to undertake all 
required functions and tasks; 
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- recruitment, training and retention of staff with 
necessary knowledge and skills to meet the Al’s needs; 


- clear assignment of authorities and responsibilities to 
appropriate staff with the necessary experience and 
capabilities; 


- proper alignment of internal resources and processes, 
where necessary; 


- effective management of changes (such as 
organisational and cultural changes) in case of need; 


- ensuring that staff at all levels fully understand their 
individual roles and responsibilities in implementing the 
plan; 


e implement an effective performance evaluation system 
through — 


- defining measures for evaluating performance in 
implementing the Al’s strategic plan; 


- evaluating and monitoring such performance regularly; 


- taking corrective actions when performance is found to 
deviate from desired outcomes; 


- conducting performance’ reviews for further 
enhancement and development; and 


e ensure that any strategic issues and material risks arising 
from environmental changes or implementation of the Al’s 
strategies are reported to the Board on a timely basis. 


4.3 Role of functional departments 


4.3.1. Management of all functional departments? of an Al involved in 
strategic planning and management processes are expected 
to — 


S Depending on the nature of strategies to be implemented, these functional departments may include non- 


business departments such as IT, human resources and finance. For example, an operational strategy 
regarding institution-wide IT development / enhancement plans will involve the IT department. 
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e assist the Board and senior management in formulating 
strategies with regard to areas under their responsibility, 
and ensure that the strategies for their departmental 
activities conform to the Aľs strategic goals and 
objectives; 


e ensure that the risk management practices and controls 
within their department are consistent with the Al’s overall 
strategic risk management framework and that 
departmental policies, processes, procedures and staff 
resources are in place to support the framework; 


e monitor departmental performance against desired 
outcomes and recommend actions to improve 
performance, where necessary; and 


e report promptly to senior management any potential issues 
or problems identified to have strategic implications for the 
Al. 


4.4 Role of strategic risk management function 


4.4.1 


4.4.2 


The strategic risk management function has the key 
responsibility of supporting the Board and senior management 
in managing an Als strategic risk and facilitating change 
processes that contribute to the Aľs organisational 
development and continuous improvement. 


The strategic risk management function is expected to be 
particularly involved in the following aspects of an Al’s strategic 
risk management framework: 


e coordinating among functional departments development 
of the strategic plan, including conducting environmental / 
strategic analyses and formulating strategies for meeting 
the Al’s strategic goals and objectives; 


e identifying, assessing and reporting potential risks posed 
to the Al by its strategies (e.g. expansion into new 
markets, products or services) and conducting stress tests 
for strategic planning and risk management purposes as 
an independent risk control; 
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4.4.3 


4.4.4 


e monitoring and evaluating the progress of implementing 
the Aľs strategic plan, conducting independent 
performance reviews and reporting the progress and 
review results to the Board and senior management 
directly; 


e ensuring that any issues and implications that may affect 
the successful achievement of the Al’s strategic goals and 
objectives are addressed in a timely manner; 


e assisting senior management and functional departments 
in managing changes (e.g. relating to organisation 
structure, culture, technology, systems and people) that 
may need to be made in order to implement the Al’s 
strategies, and ensuring effective communication of such 
changes within the Al; 


e providing advice and support on opportunities and options 
that may be pursued for the Al’s_ organisational 
development and continuous improvement; and 


e consolidating reporting to the Board and senior 
management on strategic risk issues. 


Recognising that Als operate in different ways and may define 
their strategic risk management structure differently, the HKMA 
does not propose to prescribe the manner in which the 
strategic risk management function should be structured. 
Nevertheless, like other independent risk management 
functions, the strategic risk management function will be more 
effective if its duties are clearly segregated from Als’ risk-taking 
functions. This function may be standalone, centralised or 
integrated with other risk management or supporting functions 
(e.g. financial planning and control), depending on how it fits 
into an Al’s existing management structure and the nature and 
complexity of its operations. In the case of an Al with small, 
simple operations, it may be acceptable for such function to be 
simply taken up by designated staff provided that they have the 
capability to perform the function and do not assume any 
incompatible duties (e.g. front-line risk-taking activities). 


Where an Al is a branch or subsidiary of a foreign bank, it is 


possible that the strategic risk management function is 
centralised at the head office or group level. To ensure that 
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this centralised function can work effectively and efficiently, the 
Al should have dedicated staff to provide local support and 
input to the centralised function and to assist local 
management in understanding and managing strategic risk. 


5. Strategic risk management process 


5.1 Overview 


5.1.1 An effective strategic management process should include four 
key elements: 


e strategic planning; 
e alignment and change management; 
e implementation and monitoring; and 


e performance evaluation and feedback. 


5.2 Strategic planning 
General 


5.2.1 Strategic planning is the process whereby Als determine the 
overall direction and focus of their organisation, establish 
medium and long term priorities in line with their corporate 
mission and goals, and translate those priorities into 
appropriate strategies for achieving stated goals and 
objectives. This process culminates in the development of a 
strategic plan and goes beyond, but may be integrated with, 
Als’ annual financial planning and budgeting exercise’. 


5.2.2 Strategic planning provides a process for Als to identify and 
assess potential risks posed by their strategic plan, and 
consider whether they have adequate capacity to withstand the 
risks. It also facilitates Als in responding timely to any adverse 
changes in circumstances (whether internal or external) that 


7 An annual budget is a coordinated financial plan used to monitor and control the fulfilment of an Al’s business 


and financial targets approved for the new financial year. It can be regarded as a subset of, but not a 
substitute for, the strategic plan. 
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may undermine the achievement of their plan or affect their 
future development. 


5.2.3 A strategic planning process has three basic elements: 
e a process to set an Al’s strategic goals and objectives; 


e a process to evaluate the Als strategic position and 
develop appropriate strategies; and 


e a process to translate those strategies into a strategic 
plan. 


Setting of strategic goals and objectives 


5.2.4 In setting strategic goals and objectives, Als should be guided 
by their corporate mission® which outlines the broad directions 
that the Al is to follow, and reflects the vision and values 
upheld by the Al. 


5.2.5 Strategic goals generally reflect an Al’s aspirations in relation 
to achieving growth and return, efficiency, and competitive 
advantage within the environment it operates in. Strategic 
objectives are more specific and measurable, with time 
assigned targets that are derived from strategic goals. These 
goals and objectives can both be expressed in financial terms 
(e.g. targeted loan / deposit growth rates and profit levels) and 
in non-financial terms (e.g. improvement in service quality, 
technological advancements, increase in market share, etc.). 


5.2.6 Als should ensure that their strategic goals and objectives are 
in line with their corporate mission and values, set in realistic 
terms, and fit their business nature, risk profile, and scale and 
complexity of operations. 


5.2.7 In setting strategic goals and objectives, Als should, as far as 
possible, identify and take into account the needs and 
expectations of their major stakeholders’. Changes in the 
environment (e.g. relating to political, legal, economic, social 


An Al which is part of a banking group, whether local or foreign, may be subject to the group-wide corporate 
mission set by their head office or parent bank, as the case may be. 


An Al’s stakeholders normally include its shareholders, directors, customers, employees and other parties 
such as regulators. 
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and technological changes)" may also influence the setting of 
Als’ goals and objectives. Where necessary, the implications 
of such influences for Als’ strategic decision-making should be 
analysed. 


5.2.8 Strategic goals and objectives set by Als should be clearly 
documented, effectively communicated within the organisation, 
and subject to the Board’s approval and periodical review. 


Development of strategies 


5.2.9 Als should have a process for evaluating their strategic position 
and developing appropriate strategies to achieve their strategic 
goals and objectives. 


5.2.10 Such a process should be able to provide — 


an understanding of the general banking, business and 
economic environment that an Al operates in, including 
how major environmental influences will affect the Al’s 
business and its use of products, technology and delivery 
channels": 


an assessment of the Al’s strengths and weaknesses (e.g. 
in terms of its competitive position, market standing and 
financial performance, organisation and risk management 
structures, systems and infrastructure for meeting current 
and planned business needs, managerial capacity, 
resources availability and constraints, etc.); and 


an analysis of the Al’s strategic position and possible 
strategies that can be considered, having regard to its 
stated goals and objectives and risk tolerance. 


The depth and coverage of the above analysis should be 
commensurate with the Al’s scale and complexity of business. 


5.2.11 Als should identify and develop appropriate strategies on the 
basis of the analysis made under para. 5.2.10 for inclusion in 


'0 For example, there may be increasing pressure on the banking industry to play a socially responsible role. 
Rapid technological advances may also influence the way banking products and services are delivered. 


11 


An Al may, through an environmental analysis, highlight various short and long term concerns associated with 


trends in the wider business, economic and social environment. 
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their strategic plan. As explained in para. 1.1.7, such 
strategies may need to be developed at a corporate, business 
or operational level, depending on the nature of the strategic 
goal or objective to be achieved. Sometimes, Als may need to 
develop emergent strategies in response to sudden changes in 
the environment (e.g. reacting to an unanticipated collapse of 
the stock market or taking advantage of new business 
opportunities which have been opened up). Therefore, they 
should have in place adequate procedures to handle such 
situations and ensure that their strategic planning process is 
flexible enough to allow for such changes. 


5.2.12 Als should ensure that strategies adopted — 


e are suitable for and compatible with their corporate 
mission and values, strategic goals and objectives, and 
stated risk tolerance; 


e have taken into account the needs and expectations of 
their major stakeholders; and 


e are financially and operationally feasible. 


Formulation of strategic plan 


5.2.13 


5.2.14 


Als should have a process for formulating and approving the 
strategic plan. This process and all related procedures, 
including the responsibilities of the Board and senior 
management and other staff concerned, should be clearly 
documented, approved by the Board, and subject to periodic 
review to ensure their appropriateness. 


Strategic decisions agreed upon during the planning process 
should form the basis of the strategic plan. Apart from 
describing what strategies the Al will take and how the Al will 
implement them to meet its strategic goals and objectives, the 
plan may also provide other information, such as the Al’s 
philosophy towards its business, its growth targets, the extent 
of its financial risk-taking, and other relevant factors 
(institutional and environmental) affecting its growth and 
development. The depth and coverage of the strategic plan 
should be commensurate with the Al’s scale and complexity of 
business. 
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5.2.15 


5.2.16 


5.2.17 


5.2.18 


5.2.19 


In the case of a local banking group, the strategic plan should 
be prepared on a consolidated basis (i.e. including the 
positions of subsidiaries and overseas branches). Exceptions 
to this practice should be few, and there should be good 
reasons for departing from it (see example in para. 2.4.2). 


Als which are branches or subsidiaries of a foreign bank 
should have their own strategic plan for strategic risk 
management purposes if the group’s strategic plan is not 
adequate to fully reflect their local situation, needs and 
activities. For example, if an Al is a small branch or subsidiary, 
its strategies may not be so significant as to affect the group’s 
position. Thus, it cannot rely on the group’s strategic plan to 
monitor its strategic risk. Under these circumstances, it should 
establish its own strategic plan according to the group’s 
mission, taking into account its local situation, needs and 
activities. 


There are usually business and operating plans providing 
details of implementing specific strategies set out in the 
strategic plan. Where applicable, capital and funding plans 
may be needed to outline the level of capital and funding 
required to support current operations, projected growth and 
strategies to be carried out, anticipated capital expenditures, 
and use of external capital and funding sources (see 
subsection 6.1 for more details). Such implementation plans 
should be reviewed and approved in conjunction with Als’ 
strategic planning and budgeting activities. 


Effective implementation of strategies would also depend on 
whether Als have adequate management succession plans to 
avoid disruption in the efficient functioning of the organisation 
or negative effects on strategic decision-making and to ensure 
the continuity of managerial services and availability of next-in- 
line successors whenever the need for them arises. 


Als should ensure that their strategic plan conforms to their 
stated risk tolerance and is viable, with necessary resources 
(e.g. people, systems and IT infrastructure), skills, in-house 
expertise and managerial capacity to implement the plan. 
Special attention should be paid to those strategies that may 
involve intensive resources or higher risk, such as intended 
launch into new, emerging or unfamiliar markets, significant 
cross-border acquisition projects, and planned diversification 
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5.3 


5.2.20 


5.2.21 


into new products and services in which the Al may lack 
expertise. Adequate risk assessment should be available to 
justify the strategies. 


The strategic plan usually covers a time period of three to five 
years. It should be comprehensive, well documented, properly 
approved by the Board and effectively communicated within 
the organisation. 


The strategic plan should be periodically reviewed (at least 
annually) to update any changing circumstances and ensure 
that the plan remains appropriate. Any changes to the plan, 
such as modifying existing strategies or adding new ones, 
should be subject to the same approval process. 


Alignment and change management 


5.3.1 


5.3.2 


5.3.3 


Before implementing their strategies, Als should ensure that 
they have made proper alignment of internal resources and 
processes and, if necessary, managed all change issues (such 
as those arising from organisational or cultural changes) to 
facilitate the achievement of desired outcomes. Inter- 
dependencies between processes across departments (e.g. 
reconciliation of transaction information between front and back 
offices using a more advanced IT system) should also have 
been addressed so that they can be properly understood and 
accounted for during the implementation. 


Ensuring proper alignment of internal resources and processes 
means, for example, checking to see whether — 


e sufficient resources (financial and non-financial) have 
been allocated to undertake the necessary tasks; 


e the right people have been put in the right place; and 


e the organisation and risk management structure, systems, 
infrastructure and technology etc. are in the right shape to 
support the new initiatives. 


In case there is a need for change in an area where Als may 
meet forces of resistance to change (such as organisational 
restructuring, business process re-engineering or changing of 
people’s mindset), they should develop a change programme 
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5.4 


5.4 


for ensuring a smooth and effective change. Such programme 
can be designed to suit the needs and circumstances of 
individual Als. Nonetheless, senior management should play 
an active role and act as a leader in the change process. 


Implementation and monitoring 


5.4.1 


5.4.2 


5.4.3 


5.4.4 


To determine whether a strategy will succeed or fail, it depends 
on whether an Al has adequate resources and capability to 
implement the strategy and whether the Al has the ability to 
effectively monitor and control the progress of implementation. 
As such, in addition to strategic planning, Als should have a 
process to facilitate the monitoring and control of strategies 
being implemented. 


Active Board and senior management oversight (re: subsection 
4.2), with the support of the strategic risk management function 
(re: subsection 4.4), will help ensure effective implementation 
and control of strategies. In addition, there should be adequate 
management guidelines and written procedures for 
implementing strategies and monitoring and reporting the 
progress of implementation. 


Where Als have identified strategic issues arising from 
anticipated operational or market changes which may result in 
a significant adverse impact on their business or financial 
conditions, such issues should be reported to the Board and 
senior management in a timely manner, with an assessment of 
the strategic risk implications and the need for taking remedial 
actions (such as modifying existing strategies and 
implementing risk mitigating or contingency measures). 


Als should, where appropriate, conduct stress tests on 
strategies being implemented to help identify any possible 
events or changes in the environment that could adversely 
alter the original assumptions made in the strategic plan and 
assess any potential threats to their business, both financially 
and non-financially. See subsection 6.3 for more details. 


Performance evaluation and feedback 


5.4.1 


Comparison of actual performance to desired outcomes serves 
as an important check on the success of implementing 
approved strategies, and allows management to take timely 
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5.4.2 


5.4.3 


5.4.4 


5.4.5 


5.4.6 


remedial actions to address significant deviations from set 
targets. Therefore, Als are expected to develop a performance 
evaluation system that tracks progress towards achieving both 
financial and non-financial targets. 


In developing the performance evaluation system, Als should 
clearly document the objectives of performance evaluation, the 
performance indicators or measures to be used (which may be 
quantitative or qualitative), the identification of areas and 
methodologies for measuring or evaluating performance, as 
well as evaluation benchmarks, standards and criteria to be 
adopted. ' 


In addition, Als should establish review processes which focus 
on whether actual performance meets expectations, and 
appropriate techniques and tools to measure / evaluate and 
monitor performance. Als should also have in place adequate 
systems and controls to track performance and report 
significant variances to the Board and senior management.” 


The performance evaluation system should be subject to the 
Board’s approval and periodic review to ensure that they 
remain appropriate. 


Staff in functional departments and the strategic risk 
management function responsible for performance evaluation 
(see paras. 4.3.1 and 4.4.2 respectively) should have sufficient 
training, knowledge, skills and expertise, and competence in 
performing their duties. 


Performance evaluation not only helps monitor results but also 
provides useful information to make appropriate and timely 
adjustments to strategies. Therefore, Als should take into 
account this information when formulating or reviewing their 
strategies, and their strategic planning process should allow for 
such changes. 


i. Generally speaking, performance evaluation may cover such areas as financial performance, competitiveness, 
quality of service, productivity and efficiency, and innovation. 


13 Where appropriate, trigger points on key performance indicators could be established for monitoring and 
reporting purposes such that strategies with trigger points reached would cause the Board to revisit those 


strategies. 
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6. 


14 


Other supporting processes 


6.1 


6.2 


Planning and management of capital and funding needs 


6.1.1 


Inadequate planning of capital and funding needs is an 
obstacle to implementing strategic decisions and can have a 
disruptive effect on an Al’s operations and its ability to meet 
strategic goals and objectives. As such, Als should view such 
planning as a crucial element of the strategic planning 
process. 


Capital planning should be risk-based and forward-looking, 
and take into account such factors as an Al’s current and 
future capital needs, anticipated capital expenditures, dividend 
payment forecasts, desirable capital levels, and external 
capital sources (e.g. available supply of capital and capital 
raising options).'* All these factors should be addressed in a 
capital plan that is reviewed and approved by the Board, or a 
committee delegated by the Board, (at least annually) in 
conjunction with an Al’s strategic planning and budgeting 
activities. In the case that acquisition opportunities arise, the 
capital impact and funding options should be assessed 
separately and included in the capital plan. 


Apart from capital planning, Als should ensure that adequate 
funding will be available to support their strategic plans. 
Arrangements should therefore be in place to involve the Asset 
and Liability Committee early in the strategic planning exercise. 


Als should maintain adequate policies and procedures in 
respect of how they manage their capital and funding, and 
adequate controls to ensure the adequacy and effectiveness of 
their management processes. See section 4 of CA-G-5 
“Supervisory Review Process” and section 5 of LM-1 “Liquidity 
Risk Management” for more details. 





Management information systems 


6.2.1 


In a competitive banking environment, the ability to effectively 
manage information is crucial to an Aľs ability to remain 


An Al’s capital should enable it to operate as a going concern and be sufficient to cater for business growth 
and market stresses. 
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6.3 


competitive, introduce new products and services, and achieve 
desired goals. Als should therefore ensure that they have 
sufficient MIS to support their strategic planning and decision- 
making processes. 


6.2.2 Als should ensure that the information generated from their MIS 
is accurate, complete and reliable, as the Board and senior 
management depend on such information to make decisions, 
monitor risk and measure performance. 


6.2.3 MIS needs will change when an Al grows in size, its operations 
become more complex or its strategic goals dictate a change in 
business focus requiring revisions in data collection and 
presentation. Als should have a review process to identify such 
changes to ensure the relevance, usefulness and effectiveness 
of information provided on a continuing basis. 


Stress-testing and contingency strategies 


6.3.1 Als should employ stress-testing techniques in their strategic 
planning and management processes to assess any potential 
threats to the implementation of their strategies. Stress-testing 
generally involves identifying possible events or changes in the 
external environment that could have unfavourable effects on 
an Al and assessing the Al’s ability to withstand those effects 
(see IC-5 “Stress-testing” for more guidance). 


6.3.2 Stress-testing does not necessarily mean the use of 
sophisticated financial modelling tools, but rather focuses on 
the need for Als to evaluate in some way the potential impact 
(both financial and non-financial) different stress scenarios may 
have on their business. The level of resources devoted to this 
effort should be commensurate with the nature, scale and 
complexity of Als’ business activities. 


6.3.3 When Als conduct stress tests to assess their potential 
vulnerability to adverse events or other external factors (e.g. 
unfavourable economic conditions) and/or their ability to meet 
current and emerging challenges, the stress scenarios should 
not be limited to quantitative analyses that compute potential 
losses or gains. They should also be able to project qualitative 
outcomes, including actions management might take given 
certain situations. 
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6.4 


6.3.4 


Human 


6.4.1 


6.4.2 


6.4.3 


The stress-testing results should provide feedback to strategic 
decision-making, i.e. determining whether an existing strategy 
remains appropriate or whether a change to the strategy or 
reversal of the strategic decision is warranted. For stress- 
testing outcomes that reflect risk levels which exceed internally 
established risk tolerances, Als should consider developing 
contingency strategies or appropriate, cost-effective risk 
mitigating strategies. Contingency strategies may include 
shifting of strategic focus, changing business initiatives and 
decisions, postponing strategic investment proposals and/or 
increasing internal capacity and capability. Risk mitigating 
strategies may include diversifying risk exposures or 
transferring risk to third parties. 


resources management and development 


Human resources management has a strategic focus in that it 
is involved in gaining commitments to an Al’s goals and 
shaping its corporate culture. By developing policies to meet 
future needs, human resources management enables the 
adoption of a forward-looking approach to deal with change 
and growth and to anticipate future problems. 


Human resources development has a strategic focus as well in 
that it deals with the development of staff capabilities to meet 
an Al’s current and future needs. In particular, it involves 
matters of how to enhance or widen the skills of employees 
through training, helping them adapt to changes, enabling 
them to make better use of their skills and abilities in their 
current jobs, and preparing them for future jobs. 


Als should maintain adequate policies and procedures for 
managing and developing human resources to support 
strategic developments and implementation. Such policies 
and procedures generally include — 


e developing appropriate policies, processes, oversight 
mechanism and measurement criteria to ensure that the 
recruitment, training and retention of staff meet the Al’s 
needs and that adequate staff support is provided to key 
jobs; 
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e introducing incentive schemes for motivating staff, 
improving their performance, and attracting and retaining 
staff with critical skills; 


e setting up training and development programmes to 
ensure the provision of, and better align staff capabilities 
with, required skills; and 


e developing management succession plans to cater for 
staff turnover and retirement. This is particularly essential 
for Als which anticipate major turnover in senior and 
middle management, whether due to transfer, resignation 
or retirement. 


6.5 Independent reviews and audits 


6.5.1 


6.5.2 


6.5.3 


The Board and senior management should, where necessary, 
make use of independent reviews and audits to ensure the 
integrity and effectiveness of the strategic risk management 
framework. 


Such reviews and audits can be conducted by an Al’s internal 
auditors or independent external parties (e.g. external auditors) 
that are qualified to do so, and may also take the form of ad- 
hoc reviews on specified areas. The manner in which these 
reviews and audits are to be performed (e.g. scope, timing or 
frequency, and by which party) depends on the judgement of 
the Board and senior management as to the Al’s individual 
needs, its size and structure, and the risks inherent in its 
business. 


The results of such reviews and audits, including any issues 
and weaknesses identified, should be reported to the Board 
and senior management directly. Both the Board, or a 
delegated committee (e.g. Audit Committee), and senior 
management should be sufficiently engaged in the process to 
determine whether such reviews and audits are effectively 
performed (e.g. whether the performing staff are independent 
and have sufficient authority to perform their duties) and 
identified issues are timely addressed. 
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Annex A : Common causes of strategic failure 


A1 


A2 


Introduction 


A1.1 


A1.2 


A1.3 


The purpose of this Annex is to provide a list of hypothetical 
examples illustrating some common causes of strategic failure. The 
list is compiled for Als’ reference only, and should not be regarded 
as a complete list of the possible causes of strategic failure. 


Strategic failure refers to a situation in which the improper 
formulation or implementation of strategies by a banking institution, 
or external pressures arising from the implementation of such 
strategies, have led to significant damage to the institution’s 
financial position, reputation, competitiveness or business 
development prospects. Such impact may, in the extreme 
circumstances, affect the institution’s survival as well. 


It should be noted that strategic failure seldom reflects the effect of 
a single weakness, but is often the result of two or more, or a 
combination of, factors. For example, a poorly developed strategy 
will not lead to strategic failure if the Board disapproves it. Hence, 
the focus of this Annex is to highlight those factors that may 
increase the chance of strategic failure rather than presenting each 
of them as a sole contributor to strategic failure. 


Common causes of strategic failure 


A2.1 


Planning issues 


e Strategic decisions made by an institution are not compatible 
with its risk tolerance level and deviate from its core business 


activities. For example, the institution is mainly engaged in 
traditional retail banking business but has decided to boost its 
profits by starting a fairly large operation conducting high risk 
proprietary foreign exchange derivatives trading activities in 
which it has little expertise. 


e Strategic decisions made by an institution are based on poor or 


inadequate evaluation of the strategies adopted. For example, 
the institution has not adequately assessed the need for 
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A2.2 


significant technological enhancements when considering its 
business strategies. 


Strategic decisions made by an institution are imprudent or 


overly aggressive relative to its business size and complexity. 
For example, the institution aggressively expands its private 


banking business but has neglected the fact that it does not 
have a sufficient number of experienced or well-trained 
relationship managers to handle such expansion. 


Improper diversification strategy is adopted by an _ institution, 
which disregards the institution’s lack of skills to develop the 


diversified range of new products and the high set-up costs 
involved. 


An institution clings onto its old strategies without updating them 
to take account of environmental changes, thus rendering those 


strategies ineffective and_ irrelevant. For example, the 
institution is not aware of changes in its customer behaviour and 


continually adopts the existing marketing strategy to promote its 
business. 


Inadequate risk assessment is made before an_ institution 
launches business in new, unfamiliar markets or offers new 


products and services. For example, the institution sets up a 
retail banking operation in an emerging market but has not 
adequately assessed the regulatory constraints imposed on 
foreign institutions and the implications of such constraints on 
the feasibility of such operation. 





A successful institution is over-confident of its past experience 
when making strategic decisions, thereby stifling innovation and 
reducing flexibility. For example, the institution, being a major 
player in wholesale lending business, has no intention to explore 
other viable business strategies (e.g. developing more fee- 
based business). As a result, it has forsaken opportunities to 
reduce reliance on its wholesale lending business. 


Implementation issues 


An institution is slow in responding to changes in its operating 
environment, and therefore has not_adequately considered the 
need for strategic changes. For example, the trend towards 
increasing use of internet or e-banking services by customers 
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has been overlooked by the institution, resulting in a loss of 
competitive advantage over those institutions which have 
offered those services extensively. 


A_ strategy is poorly implemented because of the _lack_of 


necessary operational / functional support (e.g. IT, human 
resources management, etc.). For example, when a major 


strategy is being implemented, certain technical officers 
responsible for implementation (with technical skills which are 
difficult to replace) resign from the institution suddenly, leaving 
behind no capable staff to carry on the implementation. 


An institution does not have adequate in-house expertise to 
implement its new strategy. For example, the institution heavily 


relies on the support of external expertise (e.g. consultancy 
services) to implement its new strategy. If the external party 
suddenly stops providing such expertise when the strategy is 
still being implemented or the expertise provided does not meet 
the institution’s expectations, this may expose the institution to 
significant business and financial losses. 


An_institution fails to take account of the difficulties in 
engendering change before implementing its new_ strategies. 
For example, the institution needs to change staff's work habits 
and requires staff to acquire new technical skills for carrying out 
some new strategies, but ignores the difficulties of bringing 
about such changes. As a result, the strategies cannot be 
successfully implemented. 


An institution does not have adequate managerial resources and 


expertise to look after its business operations. For example, 
most of the members at the Board and senior management 


levels of the institution are approaching retirement age, and the 
turnover in the middle management is significant. Without good 
management succession arrangements, the institution gradually 
loses its competitive position in the marketplace. 


An institution has lost its competitive advantages through the 


erosion or deterioration of factors that created the advantages to 
start_with. Examples causing such erosion or deterioration 


include the lack of investment in technology, insufficient 
investment in developing or enhancing risk management and 
control systems, and failure to replace primary resources that 
have run out. 
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An institution has not successfully implemented an acquisition 
deal due to various reasons, such as — 


- integration problem, clash of culture and management style; 
- acquisition price too high; 


- departure of key staff or management of the acquired 
company; or 


- unrealised promises in generating additional businesses. 


An institution has not successfully implemented a joint venture 
deal due to various reasons, such as — 


- poor structuring of the decision-making process at the outset; 


- conflict between joint venture partners because of different 
expectations; 


- difficulty in finding a reliable joint venture partner; or 


- joint venture partners becoming competitors. 


Resources (tangible or intangible) deployed to implement the 


strategies of an institution are inadequate, thus resulting in 
failure to meet set targets. For example, the institution has 


implemented a strategy to enhance overall service quality at the 
branches (due to declining customer base and rising customer 
complaints) but has failed to recruit a sufficient number of 
experienced customer service professionals to man the 
branches. 


Because of inadequate controls to monitor the progress of 
implementing a strategy, an institution has not been able to 


recognise that_a problem has occurred or that the strategy is 
failing. For example, the institution develops its personal 


lending strategy based on the assumption that the bankruptcy 
rate of individuals is below 0.5%. Such assumption is no longer 
valid with the recent surge in personal bankruptcies. Given no 
regular review of the strategy and inadequate control over the 
results of implementation, the institution is unaware that the 
default rate of its personal lending portfolios increasing rapidly. 
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Annex B : Strategic risk profile — summary of major characteristics” 
by risk category 





Risk category 





Low 





The impact of strategic decisions, or 
external pressures arising from such 
decisions, is expected to nominally 
affect franchise value. 


Strategic decisions show a continual 
pattern of being made in a sound 
manner with a history of successful 
results. 


Strategic decisions are always 
compatible with stated goals and risk 
tolerance, implemented in an 
appropriate manner, and continually 
reflect responsiveness to changes in 
the environment. 


Strategies are well conceived and 
supported by sound due diligence, 
effective risk management and control 
systems, as well as sufficient financial 
and management resources. 


The Board has always provided 
effective oversight of the planning and 
implementation of strategic goals, with 
senior management consistently 
demonstrating a high level of 
experience and expertise in carrying 
out strategic decisions successfully 
and within stated risk tolerance levels. 


Management has been successful in 
accomplishing past goals, with a 
history of excellent performance in 
providing new products and services 
and evaluating potential and 
consummated acquisitions. 


Strategic direction and organisational 
efficiency are enhanced by the depth 
of management talent. 


Strategic goals and risk management 
policies are effectively communicated 
and consistently applied throughout 
the organisation. 


Corporate structure and culture, MIS 
and other system infrastructure 
effectively support strategic direction 
and initiatives. 





Moderate 


e The impact of strategic decisions, or 
external pressures arising from such 
decisions, is not expected to 
significantly affect franchise value. 


e Strategic decisions are generally 
sound with due consideration given 
to all the relevant risks. 


e Strategic decisions are usually 
compatible with stated goals and risk 
tolerance, implemented in a proper 
manner and exhibit responsiveness 
to changes in the environment. 


e Strategies are supported by 
adequate financial and management 
resources. 


e The quality of due diligence and risk 
management and control systems is 
consistent with the strategic issues 
confronting the institution. 


e The Board generally provides 
effective oversight of the planning 
and implementation of strategic 
goals, with senior management 
possessing the necessary 
experience in carrying out strategic 
decisions within stated risk tolerance 
levels. 


e Management has demonstrated the 
ability to implement past goals, and 
has a reasonable record in decision- 
making and controls. 


e Management has exhibited, for the 
most part, good past performance in 
providing new products and services 
and evaluating potential and 
consummated acquisitions. 


e Strategic goals and risk management 
policies are appropriately 
communicated and consistently 
applied throughout the organisation. 


e Corporate structure and culture, MIS 
and other system infrastructure 
reasonably support strategic 
direction and initiatives. 





High 


The impact of strategic decisions, or external 
pressures arising from such decisions, is expected 
to adversely affect franchise value. 


Strategic goals may be non-existent, poorly 
defined, overly aggressive or incompatible with 
business direction. 


Emphasis on substantive growth or expansion may 
result in earnings volatility or capital pressure. 


Strategic decisions may be difficult or costly to 
reverse. 


A history of poor strategic decisions on a frequent 
basis continues to expose the institution to 
negative financial results. This, coupled with a 
pattern of improper implementation of strategic 
decisions or frequent lack of responsiveness to 
changes in the environment, continues to increase 
the potential for significant financial losses and 
reputation risk. 


Management or available resources may be 
insufficient to accomplish planned initiatives or to 
make necessary competitive changes. 


Lack of adequate due diligence, and less than 
effective risk management and control systems, 
have resulted in deficiencies in management 
decision-making abilities, and may undermine 
effective evaluation of resources and commitment 
to new products and services, or acquisitions. 


The Board has been totally ineffective in 
overseeing strategic decisions and improving the 
quality of senior management. 


Senior management lacks the experience 
necessary to effectively direct the communication, 
implementation and modification of strategic plans 
and maintain consistency with stated risk tolerance 
levels. 


Management has a track record of poor past 
performance in offering new products and services 
and evaluating potential and consummated 
acquisitions. 


Strategic goals and risk management policies may 
not be clearly communicated and consistently 
applied throughout the organisation. 


Corporate structure and culture, MIS and other 
system infrastructure may be insufficient to support 
strategic direction or address a changing 
environment. 





This Annex is compiled for Als’ reference only. The characteristics shown are not necessarily all-inclusive, 
and every characteristic within a risk category does not have to be met in order for an Al to be categorised 


under that risk category. 
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